Windows 10/11 - Select the Target Feature Update Version

Intro:

In Windows 10 and Windows 11, you can select a Target Feature Update Version to control which specific version of the operating system your device installs. This is especially useful in enterprise environments or for individual users who want to delay upgrading to a newer version for stability, compatibility, or testing purposes.

How to Select the Target Feature Update Version:

Using Group Policy:

1. Open the Group Policy Editor:

   • Press Win + R, type gpedit.msc, and press Enter.

2. Navigate to:

   • Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Updates.

3. Locate and configure the policy:

   • Find Select the target Feature Update version.
   • Double-click to open the policy settings.
   • Set it to Enabled.
   • Reference this link for the next bit of information: aka.ms/WindowsTargetVersioninfo
   • Enter "Windows 10" or "Windows 11" in the first box.
   • Enter the Target Version (e.g., 21H2 for Windows 10, or 22H2 for Windows 11).

4. Apply and save:

• Click OK to save the changes.

Using Registry Editor:

1. Open the Registry Editor:

   • Press Win + R, type regedit, and press Enter.

2. Navigate to:

   • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate.

3. Create or modify the keys:

   • Right-click in the right pane and select New > DWORD (32-bit) Value.
   • Name the value: TargetReleaseVersion.
   • Set its data to 1.

4. Specify the target version:

   • Right-click again and create a new String Value.
   • Name it: TargetReleaseVersionInfo.
   • Set the data to your desired version (e.g., 21H2 or 22H2).

5. Close the editor and restart your system.

Using PowerShell:

For a more automated approach, use PowerShell to set the target version:

1. Open PowerShell as Administrator.
2. Run the following commands:

   powershell
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name "TargetReleaseVersion" -Value 1
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name "TargetReleaseVersionInfo" -Value "22H2"
   

Notes:

• TargetReleaseVersionInfo must match the official version names (e.g., 22H2 for the second half of 2022).
• This setting will prevent the device from installing a newer feature update than the specified version.
• Security updates and cumulative updates for the specified version will still be installed.

👽

How to Disable Windows Defender on Windows 10/11 Pro & Enterprise

Intro:

This article is derived from a Reddit post I made a while back regarding the inability to completely turn off Windows Defender. The link to the Reddit post is located here, however if anything changes to this process after 05/08/22, I will only update this blog post here going forward. If someone happens to delete the Reddit post this document will still exist.

Do yourself a favor and read the entire article before acting.

Problem:

Microsoft Defender Antivirus should be disabled after the setting in Local Group Policy is enabled but for some reason the setting in group policy reverts to "Not Configured". I've restarted and tried over and over again about 4 times now. Initially this is the problem that was occuring, more of a glitch than anything.

I have detailed everything that I have tried as different Windows Updates have come along just as the Reddit post details, however the latest update as of 05/08/22 is number five. So skip to that if you want an answer on how to Disable Windows Defender in Windows 10 build 19044.1682. From the limited testing that I have done, this method will not work on any version of Windows 10 Home.

EDIT: 03/13/23 - Follow Update 6 for Windows 11 Pro & Enterprise

Solution(s):

IF YOU HAPPEN TO COME ACROSS THIS POST PLEASE READ UPDATE #5 BELOW FOR THE LATEST INFORMATION!

Original Instructions:

I know this won't work unless you disable tamper protection first. However it's not working as expected. Worked fine in v1909, didn't test v2004.

1. Disable Tamper Protection.
2. Restart (shouldn't have to but whatever)
3. gpedit.msc - enable "Turn off Microsoft Defender Antivirus"
4. gpupdate.exe
5. Restart for good measure, refer to #2 ;)

Microsoft Defender Antivirus should be disabled but for some reason the setting in group policy reverts to "Not Configured". I've restarted and tried over and over again about 4 times now. Same problem. This has to be a glitch.

** Update #1 **

1. Turn all Defender settings back on via control panel. Verified anything related to Defender is "Not Configured" in group policy.
2. Restart.
3. Disable Tamper Protection
4. Restart
5. gpedit.msc - enable "Turn off Microsoft Defender Antivirus"
6. gpupdate.exe
7. Restart agaaaaiiiiiinnnnnnnn
8. Now it works as expected. It took forever (3-4 minutes) for Windows to check it's own setting and come back with....."Getting protection info" when you go into Windows Security.

** UPDATE #2 **

After a restart now it doesn't work again. It's still disabled in gpedit.msc lol. What the fuck is going on?

** UPDATE #3 **

Tried disabling via the registry:

1. In the Windows Start menu or search box, enter regedit.exe, and then press Enter.The Registry Editor opens.
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
3. In the right pane, right-click in the empty area, and then click New > DWORD (32-bit) Value.
4. Enter DisableAntiSpyware, and press Enter.
5. Double-click DisableAntiSpyware, and change "Value data" to 1.
6. Restart the computer.Windows Defender is now disabled.

Side note: Scratch that idea. M$ disabled doing it this way and deletes the DisableAntiSpyware key for you, own its own🤦‍♂️: https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware

** UPDATE #4 **

Several restarts later and toggling Tamper Protection on and off, it finally worked. Follow steps at beginning of post and omit step #2.

** UPDATE #5 - 05/08/22 **

A Reddit user stated that this method does not work. In my findings if you use Windows 10 Home 19044.1165 or 19044.1682 and a hack to enable "Local Group Policy Editor", disabling Windows Defender via group policy hacks on Windows 10 Home does not work.

The hack used is this exact one via the .bat file, "https://www.majorgeeks.com/content/page/enable_group_policy_editor_in_windows_10_home_edition.html"

** UPDATE #6 - 03/13/23 **

Updated this post for Windows 11 Pro & Enterprise. This has been tested with Version 22H2 (OS Build 22621.1344).

--------------------

Ok so here we go & remember we're treating these directions as if Windows Defender was still turned on and has its default settings (Not Configured in gpedit.msc):

Windows 10 Pro & Enterprise build # 19044.1165 ➡ Go straight to "gpedit.msc" and enable "Turn off Microsoft Defender Antivirus", reboot, and you're good to go.

Windows 10 Pro & Enterprise build # 19044.1682 ➡ Turn off "Tamper Protection" ➡ reboot ➡ "gpedit.msc" ➡ enable "Turn off Microsoft Defender Antivirus" ➡ reboot (if you don't do "gpupdate" you'll have to wait about 2 minutes and you'll see, "Getting Protection Info...." when you check the status of Windows Defender in Settings). You're good to go after this.

Windows 10 Pro & Enterprise build # 19044.1706 ➡ Turn off "Tamper Protection" ➡ reboot ➡ "gpedit.msc" ➡ enable "Turn off Microsoft Defender Antivirus" ➡ reboot and wait a few minutes before checking the status of "Virus & threat protection" as you'll see "Getting Protection Info...." when you check the status of Windows Defender in Settings. You're good to go after this and after Getting Protection Info stops loading you'll see the following in the Windows Security dialog box (see image below).

--------------------

Windows 11 Pro & Enterprise build # 22621.1344 & Windows Server 2022 21H2 ➡ Turn off "Tamper Protection" ➡ reboot ➡ "gpedit.msc" ➡ (Computer Configuration ➡ Administrative Templates ➡ Windows Components ➡ Microsoft Defender Antivirus ➡ enable "Turn off Microsoft Defender Antivirus) ➡ reboot and wait a few minutes before checking the status of "Virus & threat protection" as you'll see "Getting Protection Info...." when you check the status of Windows Defender in Settings. You're good to go after this and after Getting Protection Info stops loading you'll see the following in the Windows Security dialog box (see image below).

You may need to Toggle the Group Policy key more than once before it actually sets. Ask Microsoft about this one🤷‍♂️.

--------------------

Tamper Protection is located here:

Settings ➡ Update & Security ➡ Windows Security (left side) ➡ Virus & threat protection ➡ Virus & threat protection settings ➡ Tamper Protection (4th one down).

The Local Group Policy you're toggling above is located here:

Local Computer Policy ➡ Computer Configuration ➡ Administrative Templates ➡ Windows Components ➡ Microsoft Defender Antivirus ➡ Turn off Microsoft Defender Antivirus

--------------------

Reboot and check Settings ➡ Updates & Security ➡ Windows Security ➡ Virus & threat protection ➡ It should say, "Your Virus & threat protection is managed by your organization" in red. Under that it will say, "No active antivirus provider. Your device is vulnerable".

CTRL + ALT + DELETE ➡ Task Manager ➡ Details ➡ "msmpeng.exe" should not be running after you disable MS Defender. If it's still running please comment back here and I'll try to find a workaround.

If you decide to change the setting in Local Group Policy back to "Not Configured", reboot, wait approximately 5 minutes check status of Windows Defender (some settings will appear to be correct and most aren't), reboot, wait another 2-3 minutes and check again. Windows Defender will turn back on all the settings except Tamper Protection. You need to manually turn that back on. When you check the status again everything will be in the green.

Windows does not need to be activated to make any of the above changes.

Update # 3's side note is still valid in that Windows will delete the 32 bit DWORD key upon reboot.

--------------------

PS: Microsoft I'm tired of beta testing your "final products" and not being paid for it.

Icon at top of post found here: https://icons8.com/icon/A9Yu0Sfpf7h2/windows-defender

👽